ISO 42001 Clause 7.1: Resource the AI Management System

What clause 7.1 requires in practice

Clause 7.1 requires the organisation to decide what resources are needed to establish, implement, maintain and continually improve the AI management system, and to supply them. It has two parts: working out what is needed, then actually providing it. Both cover the whole life of the system, not only the initial build.

Resources are not limited to money. They include people with suitable knowledge, time to perform assigned tasks, access to supplier and operating information, tools and the ability to obtain specialist advice. A note directs readers to Annex A theme A.4, which contains controls on AI resources such as data, tooling, computing and human resources, with guidance in Annex B. Those controls and this clause are related but different: the clause concerns resources for the management system, while the Annex A theme concerns resources for AI systems. The standard prescribes no minimum headcount or department.

Start from the work the system requires

As a practical method, examine an assessment, an operating control and an improvement action. Identify what each activity needs to produce a credible result. That may include knowledgeable people, access to supplier information, suitable tools, review time or the ability to obtain specialist advice. A single budget total will not reveal all these dependencies.

Consider ongoing maintenance as well as initial implementation. AI uses, suppliers and operating conditions can change. Resources sufficient for a pilot may not support a wider service with more users, languages or locations. Resourcing decisions should reflect those conditions rather than assume that the original project team can absorb every later responsibility.

Why resourcing matters to the business

A responsibility without resources is a promise nobody can keep. If assessments need specialist input and none is available, or monitoring depends on supplier data that the contract does not provide, controls exist only on paper. Accurate resourcing helps management decide how much AI use it can safely support and when to slow down. It also avoids a typical pattern in which a project team funds implementation and leaves no capacity for reassessment, audits or improvement. Customers and auditors notice this: staff who tell them that they lack time or information to do the job described in the policy are a clear sign that the system is under-supported.

How to implement clause 7.1

Work out resources from the activities of the system, then test whether they exist at the moments they are needed.

1. List the recurring activities: assessing new uses, reviewing outputs, monitoring suppliers, investigating concerns, auditing and improving.
2. For each, identify the knowledge, time, information access and tools it needs, and who currently provides them.
3. Check for single points of failure, such as one specialist or one mailbox that carries a critical task.
4. Compare needs with commitments from management and with what the supplier contracts allow you to see, noting any information you need but cannot obtain.
5. Where resources are short, bring a decision to management: provide more, redesign the process or restrict the use.
6. Allow for maintenance after implementation, including reassessment and change in suppliers, languages or locations.
7. Record the resourcing decisions and the reasons behind them.
8. Revisit them when scope, workload or supplier terms change, so that capacity keeps pace with the real service.

Illustrative construction example: scarce review expertise

Illustrative IT example: monitoring without access

An IT provider assigns a service owner to monitor an AI supplier's performance. The contract gives the owner only a monthly availability figure, while important concerns involve answer reliability in the provider's workflow. The assigned person cannot fulfil the intended monitoring role using that figure alone.

Resource planning therefore includes access to relevant operating evidence and the capability to evaluate it. The provider considers what it can obtain from the supplier and what it needs to examine itself. A supplier's reluctance to provide information becomes a decision constraint, not an invisible assumption.

Distinguish system resources from a technical inventory

Clause 7.1 addresses resources for the AIMS. The Annex A resource theme addresses AI resource controls, including information about data, tooling, computing and people. These perspectives connect, but neither is satisfied merely by listing servers or software licences.

For an AI user organisation, relevant resources may be concentrated in understanding the use, assessing consequences and operating review arrangements. A developer may additionally need specialist development and evaluation capability. Fit the resourcing to the role rather than copy a large model developer's organisational structure.

Evidence and decisions

Common nonconformities with clause 7.1

Resource findings usually emerge when staff describe what they can really do.

• A control requires expert review but the reviewer role has no capacity, and unreviewed material is released.
• A service owner is assigned to monitor an AI supplier but receives no operating evidence from it.
• Implementation was funded as a project, and nothing is allocated for ongoing reassessment or internal audit.
• Management cannot show how it decided that the resources provided were sufficient for the scope, and no one has reviewed that judgement since.